Computer networks that interact with other networks are constantly exposed to malware, or malicious software, such as viruses, worms, botnets and Trojan horses, which are built to infiltrate every level of the computer software architecture. As mechanisms for detecting these malwares have been developed and improved, so have the numbers and variety of the malicious software. One type of malware which has increased in use in recent year relies on a domain generation algorithm (DGA) to create thousands of domain names that contact a Command and Control (C&C) channel. The C&C channel includes a C&C server which is the domain name the malware author has control over. Most of the generated domain names are random strings that are not valid domain names. However, the algorithm creates enough domain names that eventually some valid domain names are generated and out of these valid domain names eventually the C&C server is found and contacted.
By using only one C&C server, this type of malware helps the malware author maintain a small but agile physical C&C infrastructure that only needs to be configured and turned on for short periods of time. This helps malware authors keep their botnets alive for a longer period of time and prevent take downs. Moreover, the bot herder needs to register just one domain name out of the many domain names generated by the DGA to run such an operation. This helps malware authors establish a large infection base without exposing the C&C infrastructure. As a result, such malwares are highly effective and very difficult to detect.
This type of malware also makes it very difficult for static reputation systems to maintain an accurate list of all possible C&C domains. Moreover, traditional blacklisting mechanisms generally do not work in such cases. The following disclosure addresses these and other issues.